Maybe you check in our browser (F12 developer tools, etc.), what content type your server is responding with, could be

application/xhtml+xml or application/xml as well.

Then add a log.info() command at the end with some debug notes, so you can be sure, that your script actually is active, as you can see the log in the vTM event log.

I also would limit the search/replace string to e.g. "http://www.example.com", including the hostname, because your script replaces *every* "http://", also the ones pointing to external sites, so the script replaces way too much.